UK firms swamped by former employee data requests under new law

UK businesses are being inundated with data subject access requests (DSARs) from former employees, according to digital forensics firm SYTECH Consultants. The surge coincides with the full enforcement of the Data (Use and Access) Act 2025 (DUAA), which has introduced stricter requirements for handling such requests.

The regulatory changes, implemented throughout 2026, include a mandatory complaints-handling framework that took effect on 19 June 2026. Under the new rules, organisations must provide a clear pathway for data subjects to lodge complaints about how their data was processed. If an employer fails to handle a query properly or does not issue an official acknowledgement within 30 days, the matter escalates directly to the Information Commissioner’s Office (ICO), potentially leading to severe penalties.

Why former employees are filing more requests

Changes coming in October 2026 will extend the timeframe for employees to bring employment tribunal claims from three months to six months. This has led to an increase in data access requests from former workers seeking internal emails, investigation notes, and communications on platforms like Slack or WhatsApp that could be used in potential litigation.

Mark Wilshaw, Information Security Manager at SYTECH, noted that modern data requests are increasingly compiled using AI tools, meaning former employees often demand everything. While the DUAA requires searches to be reasonable and proportionate, the administrative burden of locating, auditing, and securely redacting complex digital data remains a significant challenge for internal HR and IT departments.

What non-compliance could cost

Failure to comply with data governance rules can be financially devastating. Under the updated 2026 ICO enforcement rules, top-tier penalties for serious breaches can reach up to £17.5 million or 4% of global annual turnover. To help businesses manage this risk, SYTECH has expanded its corporate and enterprise digital forensic services, offering independent support to triage, preserve, and isolate relevant historical communication data from corporate servers, mobile devices, and cloud platforms.

SYTECH’s services include executing proportional searches using advanced tools like Magnet AXIOM, secure redaction and triaging to protect third-party privacy, and court-ready reporting with expert witness support if a request leads to an employment tribunal.

Practical implications for HR teams

For HR and payroll departments, the rise in DSARs means additional workload and potential legal exposure. Teams must be prepared to respond to requests within strict timeframes and ensure that all relevant data is identified and reviewed. This may require coordination with IT to access and search multiple systems, including email archives, messaging platforms, and cloud storage.

HR professionals should be aware that the definition of personal data is broad, and former employees may request a wide range of information. While the law allows for reasonable and proportionate searches, determining what is reasonable in each case can be complex. Organisations may benefit from establishing clear internal procedures for handling DSARs, including designated personnel and documented workflows. However, rules vary by jurisdiction, and businesses should consult legal counsel for specific guidance.

SYTECH, founded in 1978, provides forensic investigation, digital device analysis, data recovery, and cybersecurity services. The firm holds ISO 17025, ISO 27001, ISO 9001, and ISO 14001 certifications.

Sources: HR News